CleanTalk executes shortcodes embedded in visitor comments
CleanTalk before 6.87 passes unauthenticated visitor comments to WordPress's shortcode engine. An attacker can insert registered shortcodes that execute server-side and render to subsequent page visitors; the impact depends on what those shortcode handlers expose or change.
- Component
- CleanTalk
- Plugin slug
cleantalk- Affected
- < 6.87
- Safe version
6.87- Published
- Sep 09, 2026
This CVE was published Sep 09, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update CleanTalk to 6.87 or later. The authoritative record identifies this release as outside the affected range.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N